1 files changed, 4 insertions, 4 deletions
diff --git a/themes/openwrt-light/luasrc/view/themes/openwrt-light/header.htm b/themes/openwrt-light/luasrc/view/themes/openwrt-light/header.htm
index 65700c2e70..5c1303bb23 100644
--- a/themes/openwrt-light/luasrc/view/themes/openwrt-light/header.htm
+++ b/themes/openwrt-light/luasrc/view/themes/openwrt-light/header.htm
@@ -49,7 +49,7 @@ require("luci.http").prepare_content("application/xhtml+xml")
 <script type="text/javascript" src="<%=resource%>/VarType.js"></script>
 <script type="text/javascript" src="<%=resource%>/XHTML1.js"></script>
 <script type="text/javascript" src="<%=resource%>/Dropdowns.js"></script>
-<title><%=striptags( hostname .. ( (node and node.title) and ' - ' .. node.title or '')) %> - LuCI</title>
+<title><%=striptags( hostname .. ( (node and node.title) and ' - ' .. pcdata(node.title) or '')) %> - LuCI</title>
 </head>
 <body class="lang_<%=luci.i18n.context.lang%>">
 
@@ -96,7 +96,7 @@ local function submenu(prefix, node)
 				local href = controller .. prefix .. v.name .. "/"
 				href = (nnode.query) and href .. luci.http.build_querystring(nnode.query) or href
 %>
-<li><a<% if nnode._menu_selected then %> class="active"<%end%> href="<%=luci.util.pcdata(href)%>"><%=nnode.title%></a><%-
+<li><a<% if nnode._menu_selected then %> class="active"<%end%> href="<%=luci.util.pcdata(href)%>"><%=pcdata(nnode.title)%></a><%-
 submenu(prefix .. v.name .. "/", nnode)
 %></li>
 <%-
@@ -122,7 +122,7 @@ if cattree and cattree.nodes then
 			local href = controller.."/"..category.."/"..k.name.."/"
 			href = (k.query) and href .. luci.http.build_querystring(k.query) or href
 %>
-<li><a<% if node._menu_selected then %> class="preactive"<%end%> href="<%=href%>"><%=node.title%></a><%
+<li><a<% if node._menu_selected then %> class="preactive"<%end%> href="<%=href%>"><%=pcdata(node.title)%></a><%
 submenu("/" .. category .. "/" .. k.name .. "/", node)
 %></li><% end
 	end
@@ -133,7 +133,7 @@ end
 <ul id="modemenu"><%
 for k,node in pairs(tree.nodes) do
 	if node.title and not node.hidden then %>
-<li><a<% if request[1] == k then %> class="active"<%end%> href="<%=controller%>/<%=k%>/"><%=node.title%></a></li><%
+<li><a<% if request[1] == k then %> class="active"<%end%> href="<%=controller%>/<%=k%>/"><%=pcdata(node.title)%></a></li><%
 	end
 end
 %>